====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN329
_____________________________________________________________________

DATE                : 18/06/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Symfony versions 5.3.x prior to
                                       5.3.2.

=====================================================================
https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one
_____________________________________________________________________


CVE-2021-32693: Authentication granted to all firewalls instead of just one

June 17, 2021


Affected versions¶

Symfony >= 5.3.0, <5.3.2 versions of the Symfony Security HTTP component
is affected by this security issue.

The issue has been fixed in Symfony 5.3.2.


Description¶

When an application defines multiple firewalls, the authenticated token
delivered by one of the firewalls is available to all other firewalls.
This can be abused when the application defines different providers for
different parts of an application. In such a situation, a user
authenticated on one part of the application is considered authenticated
on the whole application.

We now ensure that the authenticated token is only available for the
firewall that generates it.

The patch for this issue is available here for branch 5.3.


Credits¶

I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien
Lamotte for reporting the issue and Wouter J for fixing the issue.



=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================